UK aims to lead the world with new age restrictions for social media, AI chatbots

After months of promises, the UK government has pulled the trigger on regulations to restrict social media sites for children under 16. An announcement issued by the Department for Science, Innovation and Technology (DSIT), Technology Secretary Liz Kendall and Prime Minister Keir Starmer says the UK “plans to use the same model for a social media ban as Australia,” which introduced its world-first Social Media Minimum Age requirement in December 2025, setting off a wave of policy discussion worldwide that has rocked the biometrics and digital identity industry.

In keeping with Australia, the UK regulation captures “user-to-user platforms, whose purpose is to enable social interaction and which allow users to post material, alongside algorithms.” That includes Snapchat, TikTok, YouTube (sure to be controversial), Instagram, Facebook and X, but not messaging services such as WhatsApp and Signal.

But the UK wants to be more than just a follower in challenging the ubiquity of social media in kids’ lives. As such, it will also introduce “world-leading blocks on harmful functions such as livestreaming and stranger communication with children for under-16s” for a broader range of online platforms, including gaming –  restrictions, it says, that “go further than any other country.”

“Restrictions on these functionalities will also be on by default for under 16- and 17-year-olds to prevent a cliff-edge at 16. The government will also be looking in more detail at overnight curfews and breaks in infinite scrolling for under-18-year-olds and will set out more detail in July.”

The commitment comes following a public consultation that confirmed wide public support for tighter rules on social media for young people. Bipartisan consensus and political popularity have both helped spur action on the file from governments worldwide, as laws requiring age verification for access to porn pave the way for wider regulatory ambitions. The UK’s consultation showed  9 in 10 parents in support of a social media ban for children under 16.

As such, the UK announcement comes with a dose of swagger from Starmer, who calls it “a line in the sand.”

“Tech giants had their chance and failed, but we’re stepping in to protect children, back parents and set a new normal for future generations,” the prime minister says. “I’ve heard first hand from families crying out for change and we will do right by them.”

Safety buffers for FAE, robust liveness necessary for success

Leading age assurance providers certified under the UK’s Digital Verification Services (DVS) trust framework are hoping Starmer keeps his promise – and are keen to emphasize that the effectiveness of any age-related regulation depends on the safeguards and standards put in place to support implementation.

In comments emailed to Biometric Update, Yoti CEO Robin Tombs says that, “without these, even the most well-intentioned regulation risks looking strong on paper but can fall short in the real world.”

“Australia’s experience shows that legislation can establish objectives, but outcomes depend on the safeguards and standards used in practice. Age assurance is not a silver bullet; it’s one part of the puzzle for creating a safer online world.”

Tombs advocates for several key principles he says must be formalized if the UK’s social media age law is to work. They variously address critiques of the accuracy of some biometric age assurance technology, call for clear accuracy requirements, and demand “a clear distinction between age and identity checks” be made to ensure user privacy.

“Safety buffers for facial age estimation should be included as standard,” Tombs says. “When set at an appropriate level, it can strike the right balance between reducing the risk of underage users slipping through while still allowing the vast majority of eligible users to access age-restricted products, services and platforms without unnecessary friction.”

Any effective solution must have robust liveness detection to prevent bypass. Users must be given options and be allowed to choose. And “age assurance should be treated as an ongoing process, not a one-off check.”

Time to codify what counts as accurate

The meatiest items on Tombs’ list are the principles regarding privacy and accuracy. “One of the most common misconceptions about age assurance is that it requires people to prove who they are,” he says, regarding the common error in conflating identity verification with age checks. But, “designing systems using Privacy-by-Design principles and data minimization approaches allows people to prove just their age without disclosing anything else.”

This has long been a challenge for the age assurance sector, which has had trouble getting that message amplified – and, as such, still finds itself insisting that “privacy preserving age assurance is possible,” despite accumulating documentation to prove it.

However, in the call for clear minimum standards, accuracy requirements and independent performance testing, Yoti aims to cut through some of the abstraction around the language of age assurance with an appeal to measurable data. And as calls for certification and proven results grow louder, it could be hard for the UK government to ignore its current covenant with ambiguity.

The standard for the UK, as established in the Online Safety Act (OSA), is “highly effective age assurance.” However, says Tombs, “right now, there’s no consistent, measurable definition of what ‘highly effective age assurance’ looks like.”

Language in the OSA takes a principles-based approach in requiring age assurance tools that are “accurate, robust, reliable, proportionate, fair and inclusive, and non-intrusive.” Most of that, however, is still an honor system – a guideline for how providers are expected to operate, assuming they proceed in good faith.

That’s not enough, says Tombs. “There are no agreed performance thresholds, independent certification requirements or accuracy benchmarks that systems must meet.”

“Without clear standards, it becomes difficult to distinguish between solutions that have been rigorously tested and those that have not. This creates a gap between policy intent and reality. The age assurance industry already has access to robust technical standards and testing frameworks. The challenge is that many remain optional. Where organisations face competing pressures around cost and friction, optional safeguards are often the first to be watered down.”

The Yoti exec points to regulators in New York State as among the first to publish draft minimum standards and independent audit requirements for age assurance systems. “This reflects a growing recognition that principle-based requirements alone are unlikely to provide sufficient assurance that systems are effective in practice.”

UK age laws could smother age assurance for certified DVS providers

The question appears to be on the government’s radar: the announcement promises lessons “more highly effective age assurance (HEAA) measures to support compliance,” supported in part by a rapid study to be conducted by Ofcom.

Nonetheless, the push for mandated certification is more than just moral: not far underneath, one finds the simmering concern among age assurance providers that government schemes such as the EUDI Wallet, and a new OS-level age assurance requirement, could end up usurping the territory established for private sector identity providers under the DVS trust framework.

Specifically, a requirement announced by Starmer last week, which requires device-level default controls to restrict nudity for young users, threatens to choke out the anticipated role for Digital Verification Service (DVS) providers in enforcing age minimums for access to pornography. In a release, the Age Verification Providers Association (AVPA) argues that, rather than OS-level age assurance for which “no comprehensive model has yet been implemented and tested at scale” and which are often rooted in parental consent, “existing age assurance technologies and architectures are the only realistic route to delivering the policy objectives” within Starmer’s three-month timeline.

“Building the novel cross-platform architecture that appears to be envisaged, together with the associated technical standards, liability framework and commercial arrangements, is, with the best will in the world, not achievable as fast as Ministers require,” AVPA says.

Amorous AI chatbots limited to users 18 and up

The general societal trend toward regulation of the internet coincides with the emergence of AI as a new threat, used as a vehicle for disinformation and fraud – but also deployed as chatbots that some users treat as intimate companions. The UK’s extensions beyond social media include a minimum age of 18 for “romantic companion” chatbots that are designed to simulate sexual relationships or roleplay with users. “Similar intimate functionalities will be restricted for under-18s on AI chatbots more widely.”

Kendall echoes Starmer’s bravura in proclaiming that “tech companies have had countless opportunities to keep children safe, yet they have failed to act. That is why we are taking power away from the tech giants and putting it back in parents’ hands.”

But as Tombs notes, whether it’s chatbots or social platforms, laws only work if they are enforced – which means budgetary commitments to support regulators. The announcement says Kendall has written a letter to the chair of Ofcom confirming the government will ensure the regulator has the funding it needs to carry out its new responsibilities – but also to ask for “an urgent review of Ofcom’s enforcement capabilities with a clear enforcement strategy to be published as soon as possible.”

She wants it by October, and says “in particular, Ofcom should consider how age assurance can meet the standard of being highly effective.” And she wants a report filed annually.

Another key piece of enforcement machinery is the Information Commissioner’s Office (ICO), which has taken significant (and expensive) enforcement action against Reddit for “serious failures in age assurance under UK data protection law.” The ICO thus far appears to be the UK’s most consequential regulator in terms of the penalties it can apply to Big Tech, and in a statement it says it will “continue to engage with government, as well as other regulators, to ensure that any legislative changes deliver robust protection for children online. Whilst government develops its plans, the existing law still applies, and organisations should be clear that their data protection obligations remain.”

Big Tech aims to put the fear in regulators

So far, Silicon Valley has responded to the UK’s announcement with a big thumbs down emoji. A report in the Guardian says Meta, Snapchat and YouTube have all criticized the move, summoning the sinister demons of the Dark Web to instill fear in the populace.

Meta says laws like those in Australia and the UK “risk isolating teens from online communities and information, and driving them to unregulated alternatives that lack built-in protections and parental controls.” Likewise, YouTube says “blanket bans push kids out of such curated, supervised, beneficial experiences and towards anonymous, less-safe services.”

The regulatory world now finds itself in open legislative war with social media titans, and while Big Tech will employ all the same methods that Big Tobacco did to protect its interests, there are important questions policymakers can ask social platforms in return.

The assertion that youth make connections on social media should lead to a question about the quality of connections being made; simply connecting is not necessarily a virtue.

The assertion that kids will simply jump to unregulated platforms should be met with a question about which platforms, specifically, kids will go to. Big Social is not easily replicable; it came from a moment in time, and establishing new, massive social networks has not proven to be a simple task. The idea that if you take away cigarettes, kids will simply turn to crack is disingenuous; these industries earn their Big Capitals by virtue of their size and reach. Moreover, the men who have the means to stand these platforms up, or buy them outright, are grouped on the top tier of the world’s wealth, and in no rush to cede their power and influence; any legitimate competition that threatens their dominance is sure to face a well-financed pushback.

And assertions that Facebook, Instagram and other platforms are the best option because of their robust child protections can and should be met with real-time demonstrations of their failures.

The law is no longer in question. What remains to be answered is whether the UK’s promise to take on the bullies and enforce the rules is genuine – or, as the saying goes, “just for social media.”

Article Topics

AVPA  |  biometric age estimation  |  chatbots  |  digital verification service (DVS)  |  Online Safety Act  |  social media  |  UK age verification  |  UK digital ID  |  Yoti